CVE-2026-81871: 
Grafana vulnerability analysis and mitigation

CVE-2026-81871 is a TLS certificate bypass vulnerability in the OpenTelemetry-Go OTLP log gRPC exporter (go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc) that allows a network attacker to intercept or tamper with log telemetry via a man-in-the-middle attack. The vulnerability affects all versions of the package prior to v0.21.0. It was published on September 2, 2026, and disclosed publicly via the GitHub Advisory Database on September 17, 2026. The CVSS v3.1 base score is 6.5 (Medium), and the CVSS v4.0 base score is 6.3 (Medium) (Github Advisory, Feedly).

The root cause is improper certificate validation (CWE-295) and improper restriction of communication channel to intended endpoints (CWE-923). Specifically, newConfig in config.go correctly loads TLS settings — including CA certificates and client key/certificate pairs — from environment variables (OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, OTEL_EXPORTER_OTLP_LOGS_CLIENT_CERTIFICATE, OTEL_EXPORTER_OTLP_LOGS_CLIENT_KEY) into cfg.tlsCfg via loadEnvTLS. However, newGRPCDialOptions in client.go only checks cfg.gRPCCredentials and cfg.insecure, and when neither is set (the typical env-only path), it falls back to credentials.NewTLS(nil), which uses system root CAs with no client certificate — silently ignoring the operator-configured trust material. A PoC test (poc_env_tls_ignored_test.go) was included in the advisory, demonstrating that the env CA is parsed but not enforced, resulting in an x509: certificate signed by unknown authority error when the private CA is expected to be trusted (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker with a suitable man-in-the-middle position and a system-trusted certificate to intercept or modify OTLP log telemetry data that operators expected to be protected by private CA pinning or mutual TLS. The confidentiality impact includes unauthorized reading of potentially sensitive log data (e.g., application traces, error messages, infrastructure details), while the integrity impact includes the ability to alter or inject log records in transit. Availability is not affected, and there is no lateral movement risk directly from this vulnerability, but tampered telemetry could undermine security monitoring and incident response capabilities (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been released beyond the validation artifact included in the security advisory itself, and there is no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.196% (low probability of exploitation in the next 30 days). Exploitation requires a network attacker to be in a position to intercept or spoof the gRPC connection to the OTLP collector and possess a certificate trusted by the system root store — making opportunistic exploitation unlikely but targeted attacks feasible in adversarial network environments (Feedly).

1. Identify target: Locate applications using go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc versions prior to v0.21.0 that configure TLS exclusively via environment variables (OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, etc.) without using WithTLSCredentials.
2. Gain network position: Position yourself on the network path between the application and its OTLP log collector (e.g., via ARP spoofing, DNS hijacking, BGP hijacking, or a compromised network device).
3. Obtain a system-trusted certificate: Acquire or generate a TLS certificate for the collector's hostname that is trusted by the system root CA store of the target host (e.g., a certificate from a public CA, or a certificate from a CA already trusted by the OS).
4. Intercept gRPC connection: Stand up a rogue gRPC server presenting the system-trusted certificate at the collector's address. Because the vulnerable exporter uses credentials.NewTLS(nil) (system roots, no client cert check), it will accept this certificate without validating against the operator-configured private CA.
5. Read or alter telemetry: Capture, inspect, or modify the OTLP log records forwarded by the application before optionally relaying them to the legitimate collector to avoid detection (Github Advisory).

• Network: Unexpected TLS handshakes to the OTLP collector endpoint using certificates issued by a public CA rather than the expected private CA; gRPC connections to the collector originating from or terminating at unexpected IP addresses.
• Logs: Application logs showing successful OTLP export connections despite the collector being unreachable or replaced; absence of mTLS client certificate negotiation in TLS session logs when mTLS is expected.
• Telemetry Integrity: Log records arriving at the legitimate collector with unexpected gaps, duplicates, or modified fields that do not match application-side records; collector receiving fewer records than the application reports exporting.

Upgrade the go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc package to v0.21.0 or later, which fixes the issue by adding a case cfg.tlsCfg.Value != nil branch in newGRPCDialOptions that correctly applies environment-configured TLS settings to gRPC transport credentials (Patch Commit, Release v0.21.0). As a workaround prior to patching, applications can explicitly supply TLS credentials using the WithTLSCredentials option when constructing the exporter, which bypasses the broken environment variable path and enforces the intended CA pinning and mTLS configuration (Github Advisory).

The vulnerability was reported by pellared and analyzed by MrAlias (Tyler Yahn) within the OpenTelemetry-Go project, with the fix co-authored by both contributors (Github Advisory). Red Hat tracked the issue via Bugzilla (Bug 2535725) with medium severity and assigned it to their Product Security DevOps Team, indicating broad downstream awareness across the Red Hat ecosystem (Red Hat Bugzilla). No significant public social media discussion or independent researcher commentary has been identified beyond the official advisory.